HCL iControl CVE-2025-62340

Exploitation requires that the attacker first obtain a valid session token belonging to an already-authenticated iControl user (PR:L) - the user must have logged in but not explicitly logged out. High attack complexity (AC:H) reflects that the attacker must meet specific circumstances to acquire the token, such as physical access to an unattended browser, network-level session hijacking on a shared or unencrypted network segment, or cross-site scripting as a prerequisite (not described in this CVE). The absence of an automatic idle timeout is the enabling condition - without it, the token window remains open indefinitely. Exploitation is further constrained to confidentiality impact only (C:L); the CVSS vector confirms no integrity or availability impact is achievable. This vulnerability does not apply to scenarios where users consistently log out or where the deployment enforces timeout via a proxy or load balancer layer.

The CVSS 3.1 base score of 3.1 (Low) - vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - accurately reflects the constrained risk profile: while the application is network-accessible, the attacker must overcome high complexity conditions to obtain a valid session token AND must already possess at least low-privilege access in the environment. Impact is bounded to limited confidentiality disclosure with no integrity or availability consequence. EPSS data was not provided, but absent KEV listing and given the low CVSS, exploitation probability is expected to be minimal. No POC code is publicly available. This vulnerability is a low operational priority compared to higher-severity findings but represents a meaningful hygiene gap in session management that should be addressed in routine patching cycles rather than emergency response.

An attacker sharing a network segment with an iControl user - or gaining physical access to an unattended workstation - intercepts or directly observes a session token from a user who walked away without logging out. Because the server never expires the idle session, the attacker replays the token to the iControl web interface and gains read access to the application data under the victim's identity. No public exploit code exists to automate token interception or replay for this specific product.